Blue Team Con 2026

Every security vendor is shipping AI. Every IR team is under pressure to adopt it. And in the middle of a real incident, the gap between what AI promises and what it actually delivers becomes very concrete, very fast.


This talk is a field guide to that gap. Drawing on experience as an incident responder on T-Mobile's CIRT during Salt Typhoon and on the builder side developing AI tooling for IR, I'll walk through the specific ways AI underperforms when a breach is unfolding — hallucinated IOCs and timestamps, confident wrong answers, first-hypothesis lock-in, bias toward threat explanations over innocuous ones, lost evidence chains, context windows that collapse on real forensic data, and agents that can take down your SIEM because nobody throttled them.


For each failure mode, we'll cover why it happens, how to recognize it in tools you're evaluating or already running, and what mitigations actually hold up under incident pressure. Attendees will leave with a taxonomy of AI failure modes in IR, a set of sharp questions to ask any vendor (or internal build team) claiming to solve them, recommendations for how to solve them, and a clearer picture of how AI can augment responders versus where it quietly creates new risks.